diff --git a/sdk/core/core-arm/lib/azureServiceClient.ts b/sdk/core/core-arm/lib/azureServiceClient.ts
index 77c80cea3dbc..3d196f9dd380 100644
--- a/sdk/core/core-arm/lib/azureServiceClient.ts
+++ b/sdk/core/core-arm/lib/azureServiceClient.ts
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License. See License.txt in the project root for license information.
 
-import { HttpOperationResponse, OperationArguments, OperationSpec, RequestOptionsBase, RequestPrepareOptions, ServiceClient, ServiceClientCredentials, ServiceClientOptions, TokenCredential, WebResource, getDefaultUserAgentValue as getDefaultUserAgentValueFromMsRest } from "@azure/core-http";
+import { HttpOperationResponse, OperationArguments, OperationSpec, RequestOptionsBase, RequestPrepareOptions, ServiceClient, ServiceClientOptions, TokenCredential, WebResource, getDefaultUserAgentValue as getDefaultUserAgentValueFromMsRest } from "@azure/core-http";
 import { createLROPollerFromInitialResponse, createLROPollerFromPollState, LROPoller } from "./lroPoller";
 import { LROPollState } from "./lroPollStrategy";
 import * as Constants from "./util/constants";
@@ -27,8 +27,7 @@ export interface AzureServiceClientOptions extends ServiceClientOptions {
  * Initializes a new instance of the AzureServiceClient class.
  * @constructor
  *
- * @param {ServiceClientCredentials | TokenCredential} credentials - ApplicationTokenCredentials,
- * UserTokenCredentials, or TokenCredential object used for authentication.
+ * @param {TokenCredential} credentials - The TokenCredential used for authentication.
  * @param {AzureServiceClientOptions} options - The parameter options used by AzureServiceClient
  */
 export class AzureServiceClient extends ServiceClient {
@@ -38,7 +37,7 @@ export class AzureServiceClient extends ServiceClient {
    */
   public longRunningOperationRetryTimeout?: number;
 
-  constructor(credentials: ServiceClientCredentials | TokenCredential, options?: AzureServiceClientOptions) {
+  constructor(credentials: TokenCredential, options?: AzureServiceClientOptions) {
     super(credentials, options = updateOptionsWithDefaultValues(options));
 
     // For convenience, if the credentials have an associated AzureEnvironment,
diff --git a/sdk/core/core-arm/samples/index.html b/sdk/core/core-arm/samples/index.html
index 8b2bb3a6e2cc..e73d95d2d7cd 100644
--- a/sdk/core/core-arm/samples/index.html
+++ b/sdk/core/core-arm/samples/index.html
@@ -3,15 +3,15 @@
 
 <head>
   <title>My Todos</title>
-  <script type="text/javascript" src="../node_modules/ms-rest-ts/msRestBundle.js"></script>
-  <script type="text/javascript" src="../msRestAzureBundle.js"></script>
-  
+  <script type="text/javascript" src="../node_modules/@azure/core-http/dist/coreHttp.browser.js"></script>
+  <script type="text/javascript" src="../dist/coreArm.js"></script>
+
   <script type="text/javascript">
     document.write("hello world");
     const subscriptionId = "subscriptionId";
     const token = "token";
-    const creds = new msRest.TokenCredentials(token);
-    const client = new msRestAzure.AzureServiceClient(creds);
+    const creds = new Azure.Core.HTTP.RawTokenCredential(token);
+    const client = new Azure.Core.ARM.AzureServiceClient(creds);
     const req = {
       url: `https://management.azure.com/subscriptions/${subscriptionId}/providers/Microsoft.Storage/storageAccounts?api-version=2015-06-15`,
       method: "GET"
@@ -23,4 +23,4 @@
 <body>
 </body>
 
-</html>
\ No newline at end of file
+</html>
diff --git a/sdk/core/core-arm/samples/node-sample.ts b/sdk/core/core-arm/samples/node-sample.ts
index b4be78a66ce8..230c082da606 100644
--- a/sdk/core/core-arm/samples/node-sample.ts
+++ b/sdk/core/core-arm/samples/node-sample.ts
@@ -20,7 +20,7 @@ const apiVersion = "2017-06-01";
 // 1.5 in the curl tab you will see the actual curl request that has the bearer token in it
 // 1.6 copy paste that token here. That token is valid for 1 hour
 const token = "token";
-const creds = new coreHttp.TokenCredentials(token);
+const creds = new coreHttp.RawTokenCredential(token);
 const client = new coreArm.AzureServiceClient(creds, clientOptions);
 const req: coreHttp.RequestPrepareOptions = {
   url: `https://management.azure.com/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Storage/storageAccounts/${accountName}?api-version=${apiVersion}`,
diff --git a/sdk/core/core-arm/test/azureServiceClientTests.ts b/sdk/core/core-arm/test/azureServiceClientTests.ts
index 6654f7e49a0f..945502ea117b 100644
--- a/sdk/core/core-arm/test/azureServiceClientTests.ts
+++ b/sdk/core/core-arm/test/azureServiceClientTests.ts
@@ -2,7 +2,7 @@
 // Licensed under the MIT License. See License.txt in the project root for license information.
 
 import assert from "assert";
-import { HttpHeaders, HttpOperationResponse, RequestOptionsBase, RestError, TokenCredentials, WebResource, OperationArguments, OperationSpec, Serializer } from "@azure/core-http";
+import { HttpHeaders, HttpOperationResponse, RequestOptionsBase, RestError, SimpleTokenCredential, WebResource, OperationArguments, OperationSpec, Serializer } from "@azure/core-http";
 import { AzureServiceClient, AzureServiceClientOptions, updateOptionsWithDefaultValues } from "../lib/azureServiceClient";
 import * as msAssert from "./msAssert";
 import { LROPoller } from "../lib/lroPoller";
@@ -11,28 +11,27 @@ import { CloudErrorMapper } from "../lib/cloudError";
 describe("AzureServiceClient", () => {
   describe("constructor", () => {
     it("with no options provided", () => {
-      const client = new AzureServiceClient(new TokenCredentials("my-fake-token"));
+      const client = new AzureServiceClient(new SimpleTokenCredential("my-fake-token"));
       assert.strictEqual(client.acceptLanguage, "en-us");
       assert.strictEqual(client.longRunningOperationRetryTimeout, undefined);
     });
 
     it("with acceptLanguage provided", () => {
-      const client = new AzureServiceClient(new TokenCredentials("my-fake-token"), { acceptLanguage: "my-fake-language" });
+      const client = new AzureServiceClient(new SimpleTokenCredential("my-fake-token"), { acceptLanguage: "my-fake-language" });
       assert.strictEqual(client.acceptLanguage, "my-fake-language");
       assert.strictEqual(client.longRunningOperationRetryTimeout, undefined);
     });
 
     it("with longRunningOperationRetryTimeout provided", () => {
-      const client = new AzureServiceClient(new TokenCredentials("my-fake-token"), { longRunningOperationRetryTimeout: 2 });
+      const client = new AzureServiceClient(new SimpleTokenCredential("my-fake-token"), { longRunningOperationRetryTimeout: 2 });
       assert.strictEqual(client.acceptLanguage, "en-us");
       assert.strictEqual(client.longRunningOperationRetryTimeout, 2);
     });
 
     it("should apply the resourceManagerEndpointUrl from credentials", async function() {
-      const creds = {
-        signRequest: (request: WebResource) => Promise.resolve(request),
-        environment: { resourceManagerEndpointUrl: "foo" }
-      };
+      const creds = new SimpleTokenCredential("my-fake-token");
+      (creds as any).environment = { resourceManagerEndpointUrl: "foo" };
+
       const client = new AzureServiceClient(creds);
       // accessing protected property by casting
       assert.strictEqual((client as any).baseUri, "foo");
@@ -2586,7 +2585,7 @@ function createServiceClient(responses: HttpResponse[]): AzureServiceClient {
 }
 
 function createServiceClientWithOptions(options: AzureServiceClientOptions, responses: HttpResponse[]): AzureServiceClient {
-  return new AzureServiceClient(new TokenCredentials("my-fake-token"), Object.assign({
+  return new AzureServiceClient(new SimpleTokenCredential("my-fake-token"), Object.assign({
     httpClient: {
       sendRequest(httpRequest: WebResource): Promise<HttpOperationResponse> {
         const response: HttpResponse | undefined = responses.shift();
diff --git a/sdk/core/core-arm/test/lroPollStrategyTests.ts b/sdk/core/core-arm/test/lroPollStrategyTests.ts
index 331037e57ee6..385565c70515 100644
--- a/sdk/core/core-arm/test/lroPollStrategyTests.ts
+++ b/sdk/core/core-arm/test/lroPollStrategyTests.ts
@@ -2,14 +2,14 @@
 // Licensed under the MIT License. See License.txt in the project root for license information.
 
 import assert from "assert";
-import { HttpHeaders, HttpOperationResponse, TokenCredentials, WebResource } from "@azure/core-http";
+import { HttpHeaders, HttpOperationResponse, SimpleTokenCredential, WebResource } from "@azure/core-http";
 import { AzureServiceClient } from "../lib/azureServiceClient";
 import { getDelayInSeconds, isFinished } from "../lib/lroPollStrategy";
 
 describe("LROPollStrategy", function () {
   describe("getDelayInMilliseconds()", function () {
     it("with no AzureServiceClient.longRunningOperationRetryTimeout value and no retry-after header", function () {
-      const azureServiceClient = new AzureServiceClient(new TokenCredentials("my-fake-token"));
+      const azureServiceClient = new AzureServiceClient(new SimpleTokenCredential("my-fake-token"));
       const previousResponse: HttpOperationResponse = {
         request: new WebResource(),
         status: 200,
@@ -19,7 +19,7 @@ describe("LROPollStrategy", function () {
     });
 
     it("with 11 AzureServiceClient.longRunningOperationRetryTimeout and no retry-after header", function () {
-      const azureServiceClient = new AzureServiceClient(new TokenCredentials("my-fake-token"), { longRunningOperationRetryTimeout: 11 });
+      const azureServiceClient = new AzureServiceClient(new SimpleTokenCredential("my-fake-token"), { longRunningOperationRetryTimeout: 11 });
       const previousResponse: HttpOperationResponse = {
         request: new WebResource(),
         status: 200,
@@ -29,7 +29,7 @@ describe("LROPollStrategy", function () {
     });
 
     it("with no AzureServiceClient.longRunningOperationRetryTimeout value and 12 retry-after header", function () {
-      const azureServiceClient = new AzureServiceClient(new TokenCredentials("my-fake-token"));
+      const azureServiceClient = new AzureServiceClient(new SimpleTokenCredential("my-fake-token"));
       const previousResponse: HttpOperationResponse = {
         request: new WebResource(),
         status: 200,
@@ -39,7 +39,7 @@ describe("LROPollStrategy", function () {
     });
 
     it("with no AzureServiceClient.longRunningOperationRetryTimeout value and spam retry-after header", function () {
-      const azureServiceClient = new AzureServiceClient(new TokenCredentials("my-fake-token"));
+      const azureServiceClient = new AzureServiceClient(new SimpleTokenCredential("my-fake-token"));
       const previousResponse: HttpOperationResponse = {
         request: new WebResource(),
         status: 200,
@@ -49,7 +49,7 @@ describe("LROPollStrategy", function () {
     });
 
     it("with 11 AzureServiceClient.longRunningOperationRetryTimeout and 12 retry-after header", function () {
-      const azureServiceClient = new AzureServiceClient(new TokenCredentials("my-fake-token"), { longRunningOperationRetryTimeout: 11 });
+      const azureServiceClient = new AzureServiceClient(new SimpleTokenCredential("my-fake-token"), { longRunningOperationRetryTimeout: 11 });
       const previousResponse: HttpOperationResponse = {
         request: new WebResource(),
         status: 200,
diff --git a/sdk/core/core-auth/review/core-auth.api.md b/sdk/core/core-auth/review/core-auth.api.md
index e93ce203f34b..e899e55f48b8 100644
--- a/sdk/core/core-auth/review/core-auth.api.md
+++ b/sdk/core/core-auth/review/core-auth.api.md
@@ -22,6 +22,14 @@ export interface GetTokenOptions {
 // @public
 export function isTokenCredential(credential: any): credential is TokenCredential;
 
+// @public
+export class SimpleTokenCredential implements TokenCredential {
+    constructor(token: string, expiresOn?: Date);
+    expiresOn: Date;
+    getToken(_scopes: string | string[], _options?: GetTokenOptions): Promise<AccessToken | null>;
+    token: string;
+}
+
 // @public
 export interface TokenCredential {
     getToken(scopes: string | string[], options?: GetTokenOptions): Promise<AccessToken | null>;
diff --git a/sdk/core/core-auth/src/index.ts b/sdk/core/core-auth/src/index.ts
index 99c0cf108b17..c011e7cf40c4 100644
--- a/sdk/core/core-auth/src/index.ts
+++ b/sdk/core/core-auth/src/index.ts
@@ -8,4 +8,5 @@ export {
   isTokenCredential
 } from "./tokenCredential";
 
+export { SimpleTokenCredential } from "./simpleTokenCredential";
 export { AbortSignalLike } from '@azure/abort-controller';
diff --git a/sdk/core/core-auth/src/simpleTokenCredential.ts b/sdk/core/core-auth/src/simpleTokenCredential.ts
new file mode 100644
index 000000000000..26bb09a4bf5a
--- /dev/null
+++ b/sdk/core/core-auth/src/simpleTokenCredential.ts
@@ -0,0 +1,44 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+import { TokenCredential, GetTokenOptions, AccessToken } from "./tokenCredential";
+
+/**
+ * A TokenCredential that always returns the given token. This class can be
+ * used when the access token is already known or can be retrieved from an
+ * outside source.
+ */
+export class SimpleTokenCredential implements TokenCredential {
+  /**
+   * The raw token string.  Can be changed when the token needs to be updated.
+   */
+  public token: string;
+
+  /**
+   * The Date at which the token expires.  Can be changed to update the expiration time.
+   */
+  public expiresOn: Date;
+
+  /**
+   * Creates an instance of TokenCredential.
+   * @param {string} token
+   */
+  constructor(token: string, expiresOn?: Date) {
+    this.token = token;
+    this.expiresOn = expiresOn ? expiresOn : new Date(Date.now() + 60*60*1000);
+  }
+
+  /**
+   * Retrieves the token stored in this RawTokenCredential.
+   *
+   * @param _scopes Ignored since token is already known.
+   * @param _options Ignored since token is already known.
+   * @returns {AccessToken} The access token details.
+   */
+  async getToken(_scopes: string | string[], _options?: GetTokenOptions): Promise<AccessToken | null> {
+    return {
+      token: this.token,
+      expiresOnTimestamp: this.expiresOn.getTime()
+    };
+  }
+}
diff --git a/sdk/core/core-auth/src/tokenCredential.ts b/sdk/core/core-auth/src/tokenCredential.ts
index 4679fdd85f6c..21988399c09d 100644
--- a/sdk/core/core-auth/src/tokenCredential.ts
+++ b/sdk/core/core-auth/src/tokenCredential.ts
@@ -49,11 +49,12 @@ export interface AccessToken {
  * @param credential The assumed TokenCredential to be tested.
  */
 export function isTokenCredential(credential: any): credential is TokenCredential {
-  // Check for an object with a 'getToken' function but without
+  // Check for an object with a 'getToken' function and possibly with
   // a 'signRequest' function.  We do this check to make sure that
   // a ServiceClientCredentials implementor (like TokenClientCredentials
-  // in ms-rest-nodeauth) doesn't get mistaken for a TokenCredential.
+  // in ms-rest-nodeauth) doesn't get mistaken for a TokenCredential if
+  // it doesn't actually implement TokenCredential also.
   return credential
     && typeof credential.getToken === "function"
-    && credential.signRequest === undefined;
+    && (credential.signRequest === undefined || credential.getToken.length > 0);
 }
diff --git a/sdk/core/core-auth/test/index.spec.ts b/sdk/core/core-auth/test/index.spec.ts
index e58bea89a3aa..5f3a3da31d2f 100644
--- a/sdk/core/core-auth/test/index.spec.ts
+++ b/sdk/core/core-auth/test/index.spec.ts
@@ -30,10 +30,17 @@ describe("isTokenCredential", function () {
     }), false);
   });
 
-  it("should return false for an object that has a 'signRequest' field", () => {
+  it("should return false for an object that has a 'signRequest' field and getToken that takes no parameters", () => {
     assert.strictEqual(isTokenCredential({
       getToken: function () { },
       signRequest: function() { },
     }), false);
   })
+
+  it("should return true for an object that has a 'signRequest' field and getToken that takes parameters", () => {
+    assert.strictEqual(isTokenCredential({
+      getToken: function (scope: string) { },
+      signRequest: function() { },
+    }), true);
+  })
 });
diff --git a/sdk/core/core-http/lib/coreHttp.ts b/sdk/core/core-http/lib/coreHttp.ts
index 10161bc8ab2d..62b4c0d931fd 100644
--- a/sdk/core/core-http/lib/coreHttp.ts
+++ b/sdk/core/core-http/lib/coreHttp.ts
@@ -43,9 +43,8 @@ export {
 export { URLBuilder, URLQuery } from "./url";
 
 // Credentials
-export { TokenCredential, GetTokenOptions, AccessToken, isTokenCredential } from "@azure/core-auth";
+export { TokenCredential, GetTokenOptions, AccessToken, isTokenCredential, SimpleTokenCredential } from "@azure/core-auth";
 export { AccessTokenCache, ExpiringAccessTokenCache } from "./credentials/accessTokenCache";
-export { TokenCredentials } from "./credentials/tokenCredentials";
 export { BasicAuthenticationCredentials } from "./credentials/basicAuthenticationCredentials";
 export { ApiKeyCredentials, ApiKeyCredentialOptions } from "./credentials/apiKeyCredentials";
 export { ServiceClientCredentials } from "./credentials/serviceClientCredentials";
diff --git a/sdk/core/core-http/lib/credentials/tokenCredentials.ts b/sdk/core/core-http/lib/credentials/tokenCredentials.ts
deleted file mode 100644
index 01f4957eaabc..000000000000
--- a/sdk/core/core-http/lib/credentials/tokenCredentials.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-
-import { HttpHeaders } from "../httpHeaders";
-import { Constants } from "../util/constants";
-import { WebResource } from "../webResource";
-import { ServiceClientCredentials } from "./serviceClientCredentials";
-
-const HeaderConstants = Constants.HeaderConstants;
-const DEFAULT_AUTHORIZATION_SCHEME = "Bearer";
-
-/**
- * A credentials object that uses a token string and a authorzation scheme to authenticate.
- */
-export class TokenCredentials implements ServiceClientCredentials {
-  token: string;
-  authorizationScheme: string = DEFAULT_AUTHORIZATION_SCHEME;
-
-  /**
-   * Creates a new TokenCredentials object.
-   *
-   * @constructor
-   * @param {string} token The token.
-   * @param {string} [authorizationScheme] The authorization scheme.
-   */
-  constructor(token: string, authorizationScheme: string = DEFAULT_AUTHORIZATION_SCHEME) {
-    if (!token) {
-      throw new Error("token cannot be null or undefined.");
-    }
-    this.token = token;
-    this.authorizationScheme = authorizationScheme;
-  }
-
-  /**
-   * Signs a request with the Authentication header.
-   *
-   * @param {WebResource} webResource The WebResource to be signed.
-   * @return {Promise<WebResource>} The signed request object.
-   */
-  signRequest(webResource: WebResource) {
-    if (!webResource.headers) webResource.headers = new HttpHeaders();
-    webResource.headers.set(HeaderConstants.AUTHORIZATION, `${this.authorizationScheme} ${this.token}`);
-    return Promise.resolve(webResource);
-  }
-}
diff --git a/sdk/core/core-http/lib/serviceClient.ts b/sdk/core/core-http/lib/serviceClient.ts
index 63063241e227..17150432dfd8 100644
--- a/sdk/core/core-http/lib/serviceClient.ts
+++ b/sdk/core/core-http/lib/serviceClient.ts
@@ -1,7 +1,6 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
-import { ServiceClientCredentials } from "./credentials/serviceClientCredentials";
 import { TokenCredential, isTokenCredential } from "@azure/core-auth";
 import { DefaultHttpClient } from "./defaultHttpClient";
 import { HttpClient } from "./httpClient";
@@ -17,7 +16,6 @@ import { userAgentPolicy, getDefaultUserAgentHeaderName, getDefaultUserAgentValu
 import { redirectPolicy } from "./policies/redirectPolicy";
 import { RequestPolicy, RequestPolicyFactory, RequestPolicyOptions } from "./policies/requestPolicy";
 import { rpRegistrationPolicy } from "./policies/rpRegistrationPolicy";
-import { signingPolicy } from "./policies/signingPolicy";
 import { bearerTokenAuthenticationPolicy } from "./policies/bearerTokenAuthenticationPolicy";
 import { systemErrorRetryPolicy } from "./policies/systemErrorRetryPolicy";
 import { QueryCollectionFormat } from "./queryCollectionFormat";
@@ -133,18 +131,14 @@ export class ServiceClient {
   /**
    * The ServiceClient constructor
    * @constructor
-   * @param {ServiceClientCredentials} [credentials] The credentials object used for authentication.
+   * @param {TokenCredential} [credentials] The credentials object used for authentication.
    * @param {ServiceClientOptions} [options] The service client options that govern the behavior of the client.
    */
-  constructor(credentials?: ServiceClientCredentials | TokenCredential, options?: ServiceClientOptions) {
+  constructor(credentials?: TokenCredential, options?: ServiceClientOptions) {
     if (!options) {
       options = {};
     }
 
-    if (credentials && !isTokenCredential(credentials) && !credentials.signRequest) {
-      throw new Error("credentials argument needs to implement signRequest method");
-    }
-
     this._withCredentials = options.withCredentials || false;
     this._httpClient = options.httpClient || new DefaultHttpClient();
     this._requestPolicyOptions = new RequestPolicyOptions(options.httpPipelineLogger);
@@ -153,7 +147,7 @@ export class ServiceClient {
     if (Array.isArray(options.requestPolicyFactories)) {
       requestPolicyFactories = options.requestPolicyFactories;
     } else {
-      let credentialsOrFactory: ServiceClientCredentials | RequestPolicyFactory | undefined = undefined;
+      let authPolicyFactory: RequestPolicyFactory | undefined = undefined;
       if (isTokenCredential(credentials)) {
         // Create a wrapped RequestPolicyFactory here so that we can provide the
         // correct scope to the BearerTokenAuthenticationPolicy at the first time
@@ -175,13 +169,15 @@ export class ServiceClient {
           }
         };
 
-        credentialsOrFactory = wrappedPolicyFactory();
-      } else {
-        credentialsOrFactory = credentials;
+        authPolicyFactory = wrappedPolicyFactory();
+      } else if (credentials !== undefined) {
+        throw new Error("The credentials argument must implement the TokenCredential interface");
       }
 
-      requestPolicyFactories = createDefaultRequestPolicyFactories(credentialsOrFactory, options);
+      requestPolicyFactories = createDefaultRequestPolicyFactories(authPolicyFactory, options);
       if (options.requestPolicyFactories) {
+        // options.requestPolicyFactories can also be a function that manipulates
+        // the default requestPolicyFactories array
         const newRequestPolicyFactories: void | RequestPolicyFactory[] = options.requestPolicyFactories(requestPolicyFactories);
         if (newRequestPolicyFactories) {
           requestPolicyFactories = newRequestPolicyFactories;
@@ -405,10 +401,6 @@ export function serializeRequestBody(serviceClient: ServiceClient, httpRequest:
   }
 }
 
-function isRequestPolicyFactory(instance: any): instance is RequestPolicyFactory {
-  return typeof instance.create === "function";
-}
-
 function getValueOrFunctionResult(value: undefined | string | ((defaultValue: string) => string), defaultValueCreator: (() => string)): string {
   let result: string;
   if (typeof value === "string") {
@@ -422,19 +414,15 @@ function getValueOrFunctionResult(value: undefined | string | ((defaultValue: st
   return result;
 }
 
-function createDefaultRequestPolicyFactories(credentials: ServiceClientCredentials | RequestPolicyFactory | undefined, options: ServiceClientOptions): RequestPolicyFactory[] {
+function createDefaultRequestPolicyFactories(authPolicyFactory: RequestPolicyFactory | undefined, options: ServiceClientOptions): RequestPolicyFactory[] {
   const factories: RequestPolicyFactory[] = [];
 
   if (options.generateClientRequestIdHeader) {
     factories.push(generateClientRequestIdPolicy(options.clientRequestIdHeaderName));
   }
 
-  if (credentials) {
-    if (isRequestPolicyFactory(credentials)) {
-      factories.push(credentials);
-    } else {
-      factories.push(signingPolicy(credentials));
-    }
+  if (authPolicyFactory) {
+    factories.push(authPolicyFactory);
   }
 
   const userAgentHeaderName: string = getValueOrFunctionResult(options.userAgentHeaderName, getDefaultUserAgentHeaderName);
diff --git a/sdk/core/core-http/samples/index.html b/sdk/core/core-http/samples/index.html
index 59a62a168b70..32a857758bff 100644
--- a/sdk/core/core-http/samples/index.html
+++ b/sdk/core/core-http/samples/index.html
@@ -3,14 +3,13 @@
 
 <head>
   <title>My Todos</title>
-  <script type="text/javascript" src="../msRestBundle.js"></script>
+  <script type="text/javascript" src="../dist/coreHttp.browser.js"></script>
   <script type="text/javascript">
     document.write('hello world');
-    const msRest = className;
     const subscriptionId = "00977cdb-163f-435f-9c32-39ec8ae61f4d";
     const token = "token";
-    const creds = new msRest.TokenCredentials(token);
-    const client = new msRest.ServiceClient(creds);
+    const creds = new Azure.Core.HTTP.RawTokenCredential(token);
+    const client = new Azure.Core.HTTP.ServiceClient(creds);
     const req = {
       url: `https://management.azure.com/subscriptions/${subscriptionId}/providers/Microsoft.Storage/storageAccounts?api-version=2015-06-15`,
       method: "GET"
@@ -22,4 +21,4 @@
 <body>
 </body>
 
-</html>
\ No newline at end of file
+</html>
diff --git a/sdk/core/core-http/samples/node-sample.ts b/sdk/core/core-http/samples/node-sample.ts
index 2ddce437a6df..30fb69c5cadd 100644
--- a/sdk/core/core-http/samples/node-sample.ts
+++ b/sdk/core/core-http/samples/node-sample.ts
@@ -3,9 +3,9 @@
 
 "use strict";
 
-import * as msRest from "../lib/coreHttp";
-const clientOptions: msRest.ServiceClientOptions = {
-  requestPolicyFactories: [msRest.logPolicy()]
+import * as coreHttp from "../lib/coreHttp";
+const clientOptions: coreHttp.ServiceClientOptions = {
+  requestPolicyFactories: [coreHttp.logPolicy()]
 };
 
 const subscriptionId = process.env["AZURE_SUBSCRIPTION_ID"] || "subscriptionId";
@@ -18,13 +18,13 @@ const subscriptionId = process.env["AZURE_SUBSCRIPTION_ID"] || "subscriptionId";
 // 1.5 in the curl tab you will see the actual curl request that has the bearer token in it
 // 1.6 copy paste that token here. That token is valid for 1 hour
 const token = process.env["ACCESS_TOKEN"] || "token";
-const creds = new msRest.TokenCredentials(token);
-const client = new msRest.ServiceClient(creds, clientOptions);
-const req: msRest.RequestPrepareOptions = {
+const creds = new coreHttp.SimpleTokenCredential(token);
+const client = new coreHttp.ServiceClient(creds, clientOptions);
+const req: coreHttp.RequestPrepareOptions = {
   url: `https://management.azure.com/subscriptions/${subscriptionId}/providers/Microsoft.Storage/storageAccounts?api-version=2015-06-15`,
   method: "GET"
 };
 
-client.sendRequest(req).then(function (res: msRest.HttpOperationResponse) {
+client.sendRequest(req).then(function (res: coreHttp.HttpOperationResponse) {
   console.log(res.bodyAsText);
 });
diff --git a/sdk/core/core-http/test/credentialTests.ts b/sdk/core/core-http/test/credentialTests.ts
index e874d94357a6..beac96db970d 100644
--- a/sdk/core/core-http/test/credentialTests.ts
+++ b/sdk/core/core-http/test/credentialTests.ts
@@ -4,60 +4,12 @@
 import "chai/register-should";
 import * as msRest from "../lib/coreHttp";
 import * as base64 from "../lib/util/base64";
-const TokenCredentials = msRest.TokenCredentials;
 const BasicAuthenticationCredentials = msRest.BasicAuthenticationCredentials;
 const ApiKeyCredentials = msRest.ApiKeyCredentials;
-const dummyToken = "A-dummy-access-token";
 const fakeScheme = "fake-auth-scheme";
 const dummyUsername = "dummy@mummy.com";
 const dummyPassword = "IL0veDummies";
 
-describe("Token credentials", () => {
-  describe("usage", () => {
-    it("should set auth header with bearer scheme in request", (done) => {
-      const creds = new TokenCredentials(dummyToken);
-      const request = new msRest.WebResource();
-
-      creds.signRequest(request).then((signedRequest: msRest.WebResource) => {
-        signedRequest.headers.get("authorization")!.should.exist;
-        signedRequest.headers.get("authorization")!.should.match(new RegExp("^Bearer\\s+" + dummyToken + "$"));
-        done();
-      });
-    });
-
-    it("should set auth header with custom scheme in request", (done) => {
-      const creds = new TokenCredentials(dummyToken, fakeScheme);
-      const request = new msRest.WebResource();
-      creds.signRequest(request).then((signedRequest: msRest.WebResource) => {
-        signedRequest.headers.get("authorization")!.should.exist;
-        signedRequest.headers.get("authorization")!.should.match(new RegExp("^" + fakeScheme + "\\s+" + dummyToken + "$"));
-        done();
-      });
-    });
-  });
-
-  describe("construction", () => {
-
-    it("should succeed with token", () => {
-      (() => {
-        new TokenCredentials(dummyToken);
-      }).should.not.throw();
-    });
-
-    // it("should fail without credentials", () => {
-    //   (() => {
-    //     new TokenCredentials();
-    //   }).should.throw();
-    // });
-
-    // it("should fail without token", () => {
-    //   (() => {
-    //     new TokenCredentials(null, fakeScheme);
-    //   }).should.throw();
-    // });
-  });
-});
-
 describe("Basic Authentication credentials", () => {
   const encodedCredentials = base64.encodeString(dummyUsername + ":" + dummyPassword);
   describe("usage", () => {
diff --git a/sdk/keyvault/keyvault-certificates/src/core/keyVaultClient.ts b/sdk/keyvault/keyvault-certificates/src/core/keyVaultClient.ts
index 92969048b9cd..ba31fa277170 100644
--- a/sdk/keyvault/keyvault-certificates/src/core/keyVaultClient.ts
+++ b/sdk/keyvault/keyvault-certificates/src/core/keyVaultClient.ts
@@ -21,7 +21,7 @@ class KeyVaultClient extends KeyVaultClientContext {
    * @param credentials Credentials needed for the client to connect to Azure.
    * @param [options] The parameter options
    */
-  constructor(credentials: coreHttp.ServiceClientCredentials | coreHttp.TokenCredential, options?: coreArm.AzureServiceClientOptions) {
+  constructor(credentials: coreHttp.TokenCredential, options?: coreArm.AzureServiceClientOptions) {
     super(credentials, options);
   }
 
diff --git a/sdk/keyvault/keyvault-certificates/src/core/keyVaultClientContext.ts b/sdk/keyvault/keyvault-certificates/src/core/keyVaultClientContext.ts
index 1c1938cb230a..be974e545fd7 100644
--- a/sdk/keyvault/keyvault-certificates/src/core/keyVaultClientContext.ts
+++ b/sdk/keyvault/keyvault-certificates/src/core/keyVaultClientContext.ts
@@ -15,7 +15,7 @@ const packageName = "@azure/keyvault-certificates";
 const packageVersion = "0.0.1";
 
 export class KeyVaultClientContext extends coreArm.AzureServiceClient {
-  credentials: coreHttp.ServiceClientCredentials | coreHttp.TokenCredential;
+  credentials: coreHttp.TokenCredential;
   apiVersion?: string;
 
   /**
@@ -23,7 +23,7 @@ export class KeyVaultClientContext extends coreArm.AzureServiceClient {
    * @param credentials Credentials needed for the client to connect to Azure.
    * @param [options] The parameter options
    */
-  constructor(credentials: coreHttp.ServiceClientCredentials | coreHttp.TokenCredential, options?: coreArm.AzureServiceClientOptions) {
+  constructor(credentials: coreHttp.TokenCredential, options?: coreArm.AzureServiceClientOptions) {
     if (credentials == undefined) {
       throw new Error("'credentials' cannot be null.");
     }
diff --git a/sdk/keyvault/keyvault-certificates/src/index.ts b/sdk/keyvault/keyvault-certificates/src/index.ts
index b39aefb04a9e..04018fb38c09 100644
--- a/sdk/keyvault/keyvault-certificates/src/index.ts
+++ b/sdk/keyvault/keyvault-certificates/src/index.ts
@@ -1,5 +1,4 @@
 import {
-  ServiceClientCredentials,
   TokenCredential,
   isTokenCredential,
   RequestPolicyFactory,
@@ -45,13 +44,13 @@ export class CertificatesClient {
    * A static method used to create a new Pipeline object with the provided Credential.
    *
    * @static
-   * @param {ServiceClientCredentials | TokenCredential} The credential to use for API requests.
+   * @param {TokenCredential} The credential to use for API requests.
    * @param {NewPipelineOptions} [pipelineOptions] Optional. Options.
    * @returns {Pipeline} A new Pipeline object.
    * @memberof CertificatesClient
    */
   public static getDefaultPipeline(
-    credential: ServiceClientCredentials | TokenCredential,
+    credential: TokenCredential,
     pipelineOptions: NewPipelineOptions = {}
   ): Pipeline {
     // Order is important. Closer to the API at the top & closer to the network at the bottom.
@@ -96,20 +95,20 @@ export class CertificatesClient {
 
   public readonly pipeline: Pipeline;
 
-  protected readonly credential: ServiceClientCredentials | TokenCredential;
+  protected readonly credential: TokenCredential;
   private readonly client: KeyVaultClient;
 
   /**
    * Creates an instance of CertificatesClient.
    * @param {string} url the base url to the key vault.
-   * @param {ServiceClientCredentials | TokenCredential} The credential to use for API requests.
+   * @param {TokenCredential} The credential to use for API requests.
    * @param {(Pipeline | NewPipelineOptions)} [pipelineOrOptions={}] Optional. A Pipeline, or options to create a default Pipeline instance.
    *                                                                 Omitting this parameter to create the default Pipeline instance.
    * @memberof CertificatesClient
    */
   constructor(
     url: string,
-    credential: ServiceClientCredentials | TokenCredential,
+    credential: TokenCredential,
     pipelineOrOptions: Pipeline | NewPipelineOptions = {}
   ) {
     this.vaultBaseUrl = url;
diff --git a/sdk/keyvault/keyvault-keys/review/keyvault-keys.api.md b/sdk/keyvault/keyvault-keys/review/keyvault-keys.api.md
index 0db537a54445..c592ad5dba4f 100644
--- a/sdk/keyvault/keyvault-keys/review/keyvault-keys.api.md
+++ b/sdk/keyvault/keyvault-keys/review/keyvault-keys.api.md
@@ -10,7 +10,6 @@ import { HttpPipelineLogger } from '@azure/core-http';
 import * as msRest from '@azure/core-http';
 import { PagedAsyncIterableIterator } from '@azure/core-paging';
 import { PageSettings } from '@azure/core-paging';
-import { ServiceClientCredentials } from '@azure/core-http';
 import { ServiceClientOptions } from '@azure/core-http';
 import { TokenCredential } from '@azure/core-http';
 
@@ -126,14 +125,14 @@ export interface KeyAttributes extends ParsedKeyVaultEntityIdentifier {
 
 // @public
 export class KeysClient {
-    constructor(url: string, credential: ServiceClientCredentials | TokenCredential, pipelineOrOptions?: ServiceClientOptions | NewPipelineOptions);
+    constructor(url: string, credential: TokenCredential, pipelineOrOptions?: ServiceClientOptions | NewPipelineOptions);
     backupKey(name: string, options?: RequestOptions): Promise<Uint8Array | undefined>;
     createEcKey(name: string, options?: CreateEcKeyOptions): Promise<Key>;
     createKey(name: string, keyType: JsonWebKeyType, options?: CreateKeyOptions): Promise<Key>;
     createRsaKey(name: string, options?: CreateRsaKeyOptions): Promise<Key>;
-    protected readonly credential: ServiceClientCredentials | TokenCredential;
+    protected readonly credential: TokenCredential;
     deleteKey(name: string, options?: RequestOptions): Promise<DeletedKey>;
-    static getDefaultPipeline(credential: ServiceClientCredentials | TokenCredential, pipelineOptions?: NewPipelineOptions): ServiceClientOptions;
+    static getDefaultPipeline(credential: TokenCredential, pipelineOptions?: NewPipelineOptions): ServiceClientOptions;
     getDeletedKey(name: string, options?: RequestOptions): Promise<DeletedKey>;
     getKey(name: string, options?: GetKeyOptions): Promise<Key>;
     importKey(name: string, key: JsonWebKey, options?: ImportKeyOptions): Promise<Key>;
diff --git a/sdk/keyvault/keyvault-keys/src/core/keyVaultClient.ts b/sdk/keyvault/keyvault-keys/src/core/keyVaultClient.ts
index c2b8feed53e3..e97033c887d9 100644
--- a/sdk/keyvault/keyvault-keys/src/core/keyVaultClient.ts
+++ b/sdk/keyvault/keyvault-keys/src/core/keyVaultClient.ts
@@ -22,7 +22,7 @@ class KeyVaultClient extends KeyVaultClientContext {
    * @param [options] The parameter options
    */
   constructor(
-    credentials: coreHttp.ServiceClientCredentials | coreHttp.TokenCredential,
+    credentials: coreHttp.TokenCredential,
     options?: coreArm.AzureServiceClientOptions
   ) {
     super(credentials, options);
diff --git a/sdk/keyvault/keyvault-keys/src/core/keyVaultClientContext.ts b/sdk/keyvault/keyvault-keys/src/core/keyVaultClientContext.ts
index 3175d0a00003..3973b532d708 100644
--- a/sdk/keyvault/keyvault-keys/src/core/keyVaultClientContext.ts
+++ b/sdk/keyvault/keyvault-keys/src/core/keyVaultClientContext.ts
@@ -15,7 +15,7 @@ const packageName = "@azure/keyvault-keys";
 const packageVersion = "4.0.0-preview.2";
 
 export class KeyVaultClientContext extends coreArm.AzureServiceClient {
-  credentials: coreHttp.ServiceClientCredentials | coreHttp.TokenCredential;
+  credentials: coreHttp.TokenCredential;
   apiVersion?: string;
 
   /**
@@ -24,7 +24,7 @@ export class KeyVaultClientContext extends coreArm.AzureServiceClient {
    * @param [options] The parameter options
    */
   constructor(
-    credentials: coreHttp.ServiceClientCredentials | coreHttp.TokenCredential,
+    credentials: coreHttp.TokenCredential,
     options?: coreArm.AzureServiceClientOptions
   ) {
     if (credentials == undefined) {
diff --git a/sdk/keyvault/keyvault-keys/src/index.ts b/sdk/keyvault/keyvault-keys/src/index.ts
index 4331f89f4344..a770b397a7ef 100644
--- a/sdk/keyvault/keyvault-keys/src/index.ts
+++ b/sdk/keyvault/keyvault-keys/src/index.ts
@@ -3,7 +3,6 @@
 /* eslint @typescript-eslint/member-ordering: 0 */
 
 import {
-  ServiceClientCredentials,
   TokenCredential,
   isTokenCredential,
   RequestPolicyFactory,
@@ -93,13 +92,13 @@ export class KeysClient {
    * A static method used to create a new Pipeline object with the provided Credential.
    *
    * @static
-   * @param {ServiceClientCredentials | TokenCredential} The credential to use for API requests.
+   * @param {TokenCredential} The credential to use for API requests.
    * @param {NewPipelineOptions} [pipelineOptions] Optional. Options.
    * @returns {Pipeline} A new Pipeline object.
    * @memberof KeysClient
    */
   public static getDefaultPipeline(
-    credential: ServiceClientCredentials | TokenCredential,
+    credential: TokenCredential,
     pipelineOptions: NewPipelineOptions = {}
   ): Pipeline {
     // Order is important. Closer to the API at the top & closer to the network at the bottom.
@@ -153,7 +152,7 @@ export class KeysClient {
   /**
    * The authentication credentials
    */
-  protected readonly credential: ServiceClientCredentials | TokenCredential;
+  protected readonly credential: TokenCredential;
   private readonly client: KeyVaultClient;
 
   /**
@@ -170,14 +169,14 @@ export class KeysClient {
    * let client = new KeysClient(url, credentials);
    * ```
    * @param {string} url the base url to the key vault.
-   * @param {ServiceClientCredentials | TokenCredential} The credential to use for API requests.
+   * @param {TokenCredential} The credential to use for API requests.
    * @param {(Pipeline | NewPipelineOptions)} [pipelineOrOptions={}] Optional. A Pipeline, or options to create a default Pipeline instance.
    *                                                                 Omitting this parameter to create the default Pipeline instance.
    * @memberof KeysClient
    */
   constructor(
     url: string,
-    credential: ServiceClientCredentials | TokenCredential,
+    credential: TokenCredential,
     pipelineOrOptions: Pipeline | NewPipelineOptions = {}
   ) {
     this.vaultBaseUrl = url;
diff --git a/sdk/keyvault/keyvault-secrets/review/keyvault-secrets.api.md b/sdk/keyvault/keyvault-secrets/review/keyvault-secrets.api.md
index d0e9b0e964eb..ab4095a23d31 100644
--- a/sdk/keyvault/keyvault-secrets/review/keyvault-secrets.api.md
+++ b/sdk/keyvault/keyvault-secrets/review/keyvault-secrets.api.md
@@ -11,7 +11,6 @@ import * as msRest from '@azure/core-http';
 import { PagedAsyncIterableIterator } from '@azure/core-paging';
 import { PageSettings } from '@azure/core-paging';
 import { RequestOptionsBase } from '@azure/core-http';
-import { ServiceClientCredentials } from '@azure/core-http';
 import { ServiceClientOptions } from '@azure/core-http';
 import { TokenCredential } from '@azure/core-http';
 
@@ -99,11 +98,11 @@ export interface SecretAttributes extends ParsedKeyVaultEntityIdentifier {
 
 // @public
 export class SecretsClient {
-    constructor(url: string, credential: ServiceClientCredentials | TokenCredential, pipelineOrOptions?: ServiceClientOptions | NewPipelineOptions);
+    constructor(url: string, credential: TokenCredential, pipelineOrOptions?: ServiceClientOptions | NewPipelineOptions);
     backupSecret(secretName: string, options?: RequestOptionsBase): Promise<Uint8Array>;
-    protected readonly credential: ServiceClientCredentials | TokenCredential;
+    protected readonly credential: TokenCredential;
     deleteSecret(secretName: string, options?: RequestOptionsBase): Promise<DeletedSecret>;
-    static getDefaultPipeline(credential: ServiceClientCredentials | TokenCredential, pipelineOptions?: NewPipelineOptions): ServiceClientOptions;
+    static getDefaultPipeline(credential: TokenCredential, pipelineOptions?: NewPipelineOptions): ServiceClientOptions;
     getDeletedSecret(secretName: string, options?: RequestOptionsBase): Promise<DeletedSecret>;
     getSecret(secretName: string, options?: GetSecretOptions): Promise<Secret>;
     listDeletedSecrets(options?: GetSecretsOptions): PagedAsyncIterableIterator<SecretAttributes, SecretAttributes[]>;
diff --git a/sdk/keyvault/keyvault-secrets/src/core/keyVaultClient.ts b/sdk/keyvault/keyvault-secrets/src/core/keyVaultClient.ts
index c2b8feed53e3..e97033c887d9 100644
--- a/sdk/keyvault/keyvault-secrets/src/core/keyVaultClient.ts
+++ b/sdk/keyvault/keyvault-secrets/src/core/keyVaultClient.ts
@@ -22,7 +22,7 @@ class KeyVaultClient extends KeyVaultClientContext {
    * @param [options] The parameter options
    */
   constructor(
-    credentials: coreHttp.ServiceClientCredentials | coreHttp.TokenCredential,
+    credentials: coreHttp.TokenCredential,
     options?: coreArm.AzureServiceClientOptions
   ) {
     super(credentials, options);
diff --git a/sdk/keyvault/keyvault-secrets/src/core/keyVaultClientContext.ts b/sdk/keyvault/keyvault-secrets/src/core/keyVaultClientContext.ts
index ac9acdd91251..50a818113f2d 100644
--- a/sdk/keyvault/keyvault-secrets/src/core/keyVaultClientContext.ts
+++ b/sdk/keyvault/keyvault-secrets/src/core/keyVaultClientContext.ts
@@ -15,7 +15,7 @@ const packageName = "@azure/keyvault-secrets";
 const packageVersion = "4.0.0-preview.2";
 
 export class KeyVaultClientContext extends coreArm.AzureServiceClient {
-  credentials: coreHttp.ServiceClientCredentials | coreHttp.TokenCredential;
+  credentials: coreHttp.TokenCredential;
   apiVersion?: string;
 
   /**
@@ -24,7 +24,7 @@ export class KeyVaultClientContext extends coreArm.AzureServiceClient {
    * @param [options] The parameter options
    */
   constructor(
-    credentials: coreHttp.ServiceClientCredentials | coreHttp.TokenCredential,
+    credentials: coreHttp.TokenCredential,
     options?: coreArm.AzureServiceClientOptions
   ) {
     if (credentials == undefined) {
diff --git a/sdk/keyvault/keyvault-secrets/src/index.ts b/sdk/keyvault/keyvault-secrets/src/index.ts
index e2a62339bacf..ef759623123c 100644
--- a/sdk/keyvault/keyvault-secrets/src/index.ts
+++ b/sdk/keyvault/keyvault-secrets/src/index.ts
@@ -3,7 +3,6 @@
 /* eslint @typescript-eslint/member-ordering: 0 */
 
 import {
-  ServiceClientCredentials,
   TokenCredential,
   isTokenCredential,
   RequestPolicyFactory,
@@ -76,13 +75,13 @@ export class SecretsClient {
   /**
    * A static method used to create a new Pipeline object with the provided Credential.
    * @static
-   * @param {ServiceClientCredentials | TokenCredential} The credential to use for API requests.
+   * @param {TokenCredential} The credential to use for API requests.
    * @param {NewPipelineOptions} [pipelineOptions] Optional. Options.
    * @returns {Pipeline} A new Pipeline object.
    * @memberof SecretsClient
    */
   public static getDefaultPipeline(
-    credential: ServiceClientCredentials | TokenCredential,
+    credential: TokenCredential,
     pipelineOptions: NewPipelineOptions = {}
   ): Pipeline {
     // Order is important. Closer to the API at the top & closer to the network at the bottom.
@@ -136,7 +135,7 @@ export class SecretsClient {
   /**
    * The authentication credentials
    */
-  protected readonly credential: ServiceClientCredentials | TokenCredential;
+  protected readonly credential: TokenCredential;
   private readonly client: KeyVaultClient;
 
   /**
@@ -153,14 +152,14 @@ export class SecretsClient {
    * let client = new SecretsClient(url, credentials);
    * ```
    * @param {string} url the base url to the key vault.
-   * @param {ServiceClientCredentials | TokenCredential} The credential to use for API requests.
+   * @param {TokenCredential} The credential to use for API requests.
    * @param {(Pipeline | NewPipelineOptions)} [pipelineOrOptions={}] Optional. A Pipeline, or options to create a default Pipeline instance.
    *                                                                 Omitting this parameter to create the default Pipeline instance.
    * @memberof SecretsClient
    */
   constructor(
     url: string,
-    credential: ServiceClientCredentials | TokenCredential,
+    credential: TokenCredential,
     pipelineOrOptions: Pipeline | NewPipelineOptions = {}
   ) {
     this.vaultBaseUrl = url;
